Microsoft nudges enterprise security closer to its passwordless future. But ‘123456’ will survive.

Microsoft has made passkeys (authentication methods that use cryptographic key pairs unlocked by biometrics or PIN instead of passwords) the default authentication method for Entra ID (its cloud-based identity and access management service) as of September 1, with SMS and voice authentication being phased out by February 2027. While passkeys are more resistant to phishing attacks than passwords, experts note that enterprises will likely operate in a hybrid authentication environment for years because legacy applications, account recovery complexities, and ecosystem fragmentation create significant adoption barriers. Passwords, despite their security risks, are expected to remain in use during this transition.